Section 5 Promoting the Protection of Personal Information in the Private Sector
第五節 民間団体による個人情報の保護の推進
第四十七条（認定）
A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal information, pseudonymized personal information, or anonymized personal information (hereinafter referred to as "personal or other related information" in this Chapter) (the business in question is hereinafter referred to as a "business handling personal or other related information" in this Chapter) handles the personal information properly may receive certification from the Personal Information Protection Commission:
complaint processing under Article 53 regarding the handling of personal or other related information by businesses handling personal or other related information which are covered by the corporation's services (hereinafter each such business is referred to as a "covered business");
業務の対象となる個人情報取扱事業者等（以下この節において「対象事業者」という。）の個人情報等の取扱いに関する第五十三条の規定による苦情の処理
providing covered businesses with information about things that contribute to ensuring the proper handling of personal or other related information;
services beyond what is set forth in the preceding two items which are necessary for ensuring the proper handling of personal or other related information by covered businesses.
The certification set forth in the preceding paragraph may be limited in respect of the type or scope of services of businesses handling personal or other related information that are covered.
前項の認定は、対象とする個人情報取扱事業者等の事業の種類その他の業務の範囲を限定して行うことができる。
A person seeking the certification referred to in paragraph (1) must apply to the Personal Information Protection Commission as prescribed by Cabinet Order.
第一項の認定を受けようとする者は、政令で定めるところにより、個人情報保護委員会に申請しなければならない。
After granting a certification under paragraph (1), the Personal Information Protection Commission must make a public notice to that effect (including the scope of services concerning the certification, in cases of the certification limiting the scope of services pursuant to the provisions of paragraph (2)).
Article 48Conditions for Ineligibility
第四十八条（欠格条項）
A person falling under one of the following items may not be certified as referred to in paragraph (1) of the preceding Article:
次の各号のいずれかに該当する者は、前条第一項の認定を受けることができない。
a person that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;
この法律の規定により刑に処せられ、その執行を終わり、又は執行を受けることがなくなった日から二年を経過しない者
a person whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation;
第百五十五条第一項の規定により認定を取り消され、その取消しの日から二年を経過しない者
a person with an executive officer (or with a representative or manager, in an organization without legal personality that has made provisions for a representative or manager; hereinafter the same applies in this Article) that falls under one of the following categories:
その業務を行う役員（法人でない団体で代表者又は管理人の定めのあるものの代表者又は管理人を含む。以下この条において同じ。）のうちに、次のいずれかに該当する者があるもの
a person that has been sentenced to imprisonment or a heavier punishment or that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;
拘禁刑以上の刑に処せられ、又はこの法律の規定により刑に処せられ、その執行を終わり、又は執行を受けることがなくなった日から二年を経過しない者
a person that, during the 30 days before the revocation, was the officer of a corporation whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation.
第百五十五条第一項の規定により認定を取り消された法人において、その取消しの日前三十日以内にその役員であった者でその取消しの日から二年を経過しない者
Article 49Certification Standards
第四十九条（認定の基準）
The Personal Information Protection Commission must not grant a certification unless it finds the application for certification referred to in Article 47, paragraph (1) to conform to all of the following requirements:
個人情報保護委員会は、第四十七条第一項の認定の申請が次の各号のいずれにも適合していると認めるときでなければ、その認定をしてはならない。
the applicant has established the necessary methods of business implementation to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;
第四十七条第一項各号に掲げる業務を適正かつ確実に行うに必要な業務の実施の方法が定められているものであること。
the applicant's knowledge, capabilities, and financial base are sufficient to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;
第四十七条第一項各号に掲げる業務を適正かつ確実に行うに足りる知識及び能力並びに経理的基礎を有するものであること。
if the applicant engages in business other than the services set forth in the items of Article 47, paragraph (1), its engagement in that business is unlikely to give rise to unfairness in the services set forth in the items of that paragraph.
Article 50Certification of Alterations
第五十条（変更の認定等）
If a person that has received certification under Article 47, paragraph (1) (including that limiting the scope of services pursuant to the provisions of paragraph (2) of that Article; the same applies in paragraph (1) of the following Article and Article 155, paragraph (1), item (v)) seeks to alter the scope of services concerning the certification, the person must receive certification from the Personal Information Protection Commission; provided, however, that this does not apply to a minor alteration as prescribed by Order of the Personal Information Protection Commission.
第四十七条第一項の認定（同条第二項の規定により業務の範囲を限定する認定を含む。次条第一項及び第百五十五条第一項第五号において同じ。）を受けた者は、その認定に係る業務の範囲を変更しようとするときは、個人情報保護委員会の認定を受けなければならない。ただし、個人情報保護委員会規則で定める軽微な変更については、この限りでない。
The provisions of Article 47, paragraphs (3) and (4) and the preceding Article apply mutatis mutandis to the certification of alteration referred to in the preceding paragraph.
Article 51Notification of Discontinuation
第五十一条（廃止の届出）
Before intending to discontinue the services subject to certification (hereinafter referred to as "certified services" in this Section and Chapter VI), a person that has received certification under Article 47, paragraph (1) (including the certification of alteration under paragraph (1) of the preceding Article) (the person in question is hereinafter referred to as a "certified personal information protection organization" in this Section and Chapter VI) must notify the Personal Information Protection Commission to that effect as prescribed by Cabinet Order.
Upon receiving notification under the preceding paragraph, the Personal Information Protection Commission must issue public notice indicating this.
個人情報保護委員会は、前項の規定による届出があったときは、その旨を公示しなければならない。
第五十二条（対象事業者）
A certified personal information protection organization's covered businesses must be comprised of businesses handling personal or other related information that have agreed to be covered by its certified services. In this case, if a covered business does not comply with the personal information protection guidelines prescribed in Article 54, paragraph (1) even though measures pursuant to Article 54, paragraph (4) were taken, the covered business may be excluded from being covered by the certified services.
認定個人情報保護団体は、認定業務の対象となることについて同意を得た個人情報取扱事業者等を対象事業者としなければならない。この場合において、第五十四条第四項の規定による措置をとったにもかかわらず、対象事業者が同条第一項に規定する個人情報保護指針を遵守しないときは、当該対象事業者を認定業務の対象から除外することができる。
A certified personal information protection organization must disclose the names of its covered businesses.
認定個人情報保護団体は、対象事業者の氏名又は名称を公表しなければならない。
Article 53Complaint Processing
第五十三条（苦情の処理）
If an identifiable person or other party files for a certified personal information protection organization to resolve a complaint about the handling of personal or other related information by a covered business, in addition to complying with any request for a consultation about this, providing the identifiable person or other party with the necessary advice, and investigating the circumstances to which the complaint pertains, the organization must notify the covered business of the substance and content of the complaint and request that it resolve the complaint expeditiously.
認定個人情報保護団体は、本人その他の関係者から対象事業者の個人情報等の取扱いに関する苦情について解決の申出があったときは、その相談に応じ、申出人に必要な助言をし、その苦情に係る事情を調査するとともに、当該対象事業者に対し、その苦情の内容を通知してその迅速な解決を求めなければならない。
If a certified personal information protection organization finds that it is necessary in connection with the resolution of a complaint under a filing referred to in the preceding paragraph, the organization may request that the covered business provide a written or oral explanation or submit materials.
認定個人情報保護団体は、前項の申出に係る苦情の解決について必要があると認めるときは、当該対象事業者に対し、文書若しくは口頭による説明を求め、又は資料の提出を求めることができる。
If a covered business has received a request under the preceding paragraph from a certified personal information protection organization, it must not refuse this request without a legitimate reason for doing so.
対象事業者は、認定個人情報保護団体から前項の規定による求めがあったときは、正当な理由がないのに、これを拒んではならない。
Article 54Personal Information Protection Guidelines
第五十四条（個人情報保護指針）
In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, as well as how to produce pseudonymized processed information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.
When having developed personal information protection guidelines pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must notify the Personal Information Protection Commission of the personal information protection guidelines without delay pursuant to Order of the Personal Information Protection Commission. The same applies if the guidelines are modified.
認定個人情報保護団体は、前項の規定により個人情報保護指針を作成したときは、個人情報保護委員会規則で定めるところにより、遅滞なく、当該個人情報保護指針を個人情報保護委員会に届け出なければならない。これを変更したときも、同様とする。
When having been notified of personal information protection guidelines under the preceding paragraph, the Personal Information Protection Commission must disclose the personal information protection guidelines pursuant to Order of the Personal Information Protection Commission.
When personal information protection guidelines have been disclosed pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must take measures against a covered business such as providing guidance or recommendations necessary to make the covered business comply with the personal information protection guidelines.
認定個人情報保護団体は、前項の規定により個人情報保護指針が公表されたときは、対象事業者に対し、当該個人情報保護指針を遵守させるため必要な指導、勧告その他の措置をとらなければならない。
Article 55Prohibition against Unauthorized Use
第五十五条（目的外利用の禁止）
A certified personal information protection organization must not use information acquired in the course of certified services for purposes other than the certified services use for which the information is provided.
認定個人情報保護団体は、認定業務の実施に際して知り得た情報を認定業務の用に供する目的以外に利用してはならない。
Article 56Restriction on Name Use
第五十六条（名称の使用制限）
A person that is not a certified personal information protection organization must not use a name that refers to that person as a certified personal information protection organization, and must not use any other name that is confusingly similar to this.
認定個人情報保護団体でない者は、認定個人情報保護団体という名称又はこれに紛らわしい名称を用いてはならない。
Section 6 Miscellaneous Provisions
第六節 雑則
Article 57Exclusion from Application
第五十七条（適用除外）
The provisions of this Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:
個人情報取扱事業者等及び個人関連情報取扱事業者のうち次の各号に掲げる者については、その個人情報等及び個人関連情報を取り扱う目的の全部又は一部がそれぞれ当該各号に規定する目的であるときは、この章の規定は、適用しない。
broadcasting organizations, newspapers, news services, and other journalistic organizations (this includes individuals who work in news reporting):use in news reporting;
放送機関、新聞社、通信社その他の報道機関（報道を業として行う個人を含む。） 報道の用に供する目的
a person in the business of creating literary works:use in the creation of literary works;
著述を業として行う者 著述の用に供する目的
a religious organization:use in a religious activity (this includes activities incidental to it);
宗教団体 宗教活動（これに付随する活動を含む。）の用に供する目的
a political organization:use in a political activity (this includes activities incidental to it).
政治団体 政治活動（これに付随する活動を含む。）の用に供する目的
The "news reporting" prescribed in item (i) of the preceding paragraph means informing the general public of objective facts by presenting them as the truth (this includes stating an opinion or position based on those facts).
前項第一号に規定する「報道」とは、不特定かつ多数の者に対して客観的事実を事実として知らせること（これに基づいて意見又は見解を述べることを含む。）をいう。
A business handling personal or other related information as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.
Article 58Exception to Application
第五十八条（適用の特例）
The provisions of Articles 32 through 39 and Section 4 do not apply to a business handling personal information or a business handling anonymized personal information set forth as follows:
個人情報取扱事業者又は匿名加工情報取扱事業者のうち次に掲げる者については、第三十二条から第三十九条まで及び第四節の規定は、適用しない。
a corporation listed in Appended Table 2;
別表第二に掲げる法人
a local incorporated administrative agency whose main purpose is providing the service listed in Article 21, item (i) of the Local Incorporated Administrative Agency Act, or whose purpose is providing the service listed in item (ii) or item (iii) of that Article (limited to the part relating to (h)).
地方独立行政法人のうち地方独立行政法人法第二十一条第一号に掲げる業務を主たる目的とするもの又は同条第二号若しくは第三号（チに係る部分に限る。）に掲げる業務を目的とするもの
The handling of personal information, pseudonymized personal information, or information related to personal information conducted by a person set forth in each following items in the business prescribed in each item is deemed to be the handling of personal information by a business handling personal information, the handling of pseudonymized personal information by a business handling pseudonymized personal information, or the handling of information related to personal information by a business handling information related to personal information; and the provisions in this Chapter (excluding Articles 32 through 39 and Section 4) and Chapters VI through VIII apply to it:
次の各号に掲げる者が行う当該各号に定める業務における個人情報、仮名加工情報又は個人関連情報の取扱いについては、個人情報取扱事業者、仮名加工情報取扱事業者又は個人関連情報取扱事業者による個人情報、仮名加工情報又は個人関連情報の取扱いとみなして、この章（第三十二条から第三十九条まで及び第四節を除く。）及び第六章から第八章までの規定を適用する。
a local government organ: operation of a hospital prescribed in Article 1-5, paragraph (1) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, and a university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);
地方公共団体の機関 医療法（昭和二十三年法律第二百五号）第一条の五第一項に規定する病院（次号において「病院」という。）及び同条第二項に規定する診療所並びに学校教育法（昭和二十二年法律第二十六号）第一条に規定する大学の運営
Academic research organizations or the equivalent which are businesses handling personal information must endeavor to comply with the provisions of this Act as well as personally take necessary measures for ensuring the appropriate handling of personal information for academic research purposes, and endeavor to the public the content of those measures.